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AMENDMENTS TO THE CLAIMS 

1 . (Previously Presented) A security system for use in conjunction with data 
flowing from a first device to a second device being directed to said second device in 
accordance with a network address of said second device, said system comprising: 

a security device connected between said first and second devices, said security 
device accepting packet data for bridging to said second device, said security device operable 
for observing data flowing from said first device to said second device, said security device 
not itself having a network address or a physical address, and configured to be inserted 
between said first and said second device while a network connection is active. 

2. (Original) The security system of claim 1 wherein said first device could be 
any device on the unsecured side of said security device, each said first device having a 
unique network address, and wherein said second device could be any device on the secured 
side of said security device, each said second device having a unique network address. 

3. (Original) The security system of claim 2 wherein said security device 
maintains a list of addresses for which it has security responsibility and wherein said security 
device only observes those data packets containing the network addresses maintained in said 
list. 

4. (Original) The security system of claim 3 wherein said list includes addresses 
of both said first devices and said second devices. 

5. (Original) The security system of claim 1 wherein said observing comprises: 
a monitoring system for gathering information pertaining to the operation of said 

second device; and 

a mechanism for modifying the flow of data into said security system depending upon 
said gathered information. 
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6. (Original) The security system of claim 5 wherein said gathered information 
is selected from the list containing: 

number of arriving packets in a particular time interval; 
the type of requests contained within given packets; 
the nature of the informational content of the packets; 
the sending identity of the packets; 
the destination of the packets; 

the traffic patterns formed by packets from specific sources; 
the number of arriving packets from specific sources; 
the correctness of the packets; 

certain data contained in one or more messages; and 
the type of file attached to a message. 

7. (Original) The security system of claim 5 wherein said flow modifying 
mechanism operates to compare said gathered information with certain pre-established 
criteria and to set limits, and wherein said operational characteristics of said mechanism is 
modified in accordance with said set limits. 
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8. (Previously Presented) A security device for use in a packet data network 
where packets are delivered from a sending location to a destination location based upon one 
or more destination network addresses associated with each packet, said security device 
comprising: 

at least one NIC card for receiving data packets; 

a database for maintaining a list of destination network addresses to be secured by 
said device; 

wherein said at least one NIC card is connected to said network at any point between 
a sending location and one or more destination locations, said NIC card maintained in 
promiscuous mode such that said security device can observe all data directed to any 
destination addresses maintained from time to time in said list; 

wherein said security device is connected to said network without establishing a 
network address or a physical address for said security device; and 

wherein said security device can be moved from location to location on said network 
without changing any network settings. 

9. -10. (Canceled) 

11. (Original) The security device of claim 8 further comprising: 
a plurality of NIC cards all operating in said promiscuous mode. 

12. (Original) The security device of claim 1 1 wherein said security device has a 
zero network footprint while said NIC cards are in said promiscuous mode. 

13. (Original) The security device of claim 12 wherein all of said NIC cards share 
the same destination list. 

14. (Original) The security device of claim 8 wherein said observing comprises: 
monitoring system for gathering information pertaining to the operation of said 

second device; and 

mechanism for modifying the flow of data into said security system depending upon 
said gathered information. 
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15. (Previously Presented) The security device of claim 14 wherein said gathered 
information is selected from the list containing: 

number of arriving packets in a particular time interval; 

the type of requests contained within given packets; 

the nature of the informational content of the packets; 

the sending identity of the packets; 

the response destination of the packets; 

the traffic patterns formed by packets from specific sources; 

the number of arriving packets from specific sources; 

certain data contained in one or more messages; and 

the type of file attached to a message. 

16. (Original) The security device of claim 1 5 wherein said flow modifying 
mechanism operates to compare said gathered information with certain pre-established 
criteria and to set limits, and wherein said operational characteristics of said gateway router 
are modified in accordance with said set limits. 

17. -27. (Cancelled) 

28. (Previously Presented) A security device for connection in a data network 
ahead of a plurality of data destinations to be protected, each said destination identifiable by a 
unique network address, said security device comprising: 

means for accepting data packets from said network without said data packets being 
addressed to said security device, said security device not including a physical address; and 

means for passing accepted data packets to particular ones of said data destinations in 
accordance with destination addresses of said destinations to be detected and maintained for 
said security device. 

29. (Original) The security device of claim 28 wherein said maintained 
destination addresses are stored in a database internal to said security device. 

30. (Original) The security device of claim 28 wherein said accepting means 
comprises: 

at least one network termination operating in a promiscuous mode. 
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31. -35. (Cancelled) 
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